From bf7880e36757ffa2cb4969f80ffd64bd1baa9fef Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Tue, 6 Oct 2026 08:28:34 +0000 Subject: [PATCH] dev2 supabase-stack: turn off phone signup autoconfirm Upstream .env.example ships ENABLE_PHONE_SIGNUP=true and ENABLE_PHONE_AUTOCONFIRM=true. With no SMS provider configured, anyone can POST /auth/v1/signup {phone, password} with a made-up number and get a live session, bypassing the email confirmation the template already enforces. Verified on smshub.dev 2026-10-06; 21 other dev2 stacks carry the same env. Autoconfirm is now always off, and phone signup is on only when the site's volumes/auth/auth.env configures GOTRUE_SMS_PROVIDER or a send-SMS hook (qrypt.chat), so a re-run does not break a site that really uses phone auth. Co-Authored-By: Claude Opus 5.5 --- dev2/README.md | 2 +- dev2/templates/supabase-stack.sh | 11 +++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/dev2/README.md b/dev2/README.md index 46131cf..d404616 100644 --- a/dev2/README.md +++ b/dev2/README.md @@ -32,7 +32,7 @@ dev2-site migrate --yes the whole move, resumable; each step below is a | `railway-stop` | `deploymentRemove` + `serviceDisconnect` (or the next push silently redeploys on Railway) | | `merge` | merges the scaffold PR; CI deploys the default branch to dev2 | | `retire` | `--yes`: `serviceDelete` for the app, companions and data services. Only after `verify --public` | -| `supabase-stack` | (kind `supabase`, second pass) a self-hosted Supabase stack of its own under `~/www//supabase` (compose project `-supabase`, api `8200+n`, db `5500+n`, pooler `6600+n`, subnet `172.31.(100+n).0/24`, `n = port-3200`), public host `supabase.` added to the site's cert/vhost/dns via `sites.d`. The `auth` service also reads `volumes/auth/auth.env` (created empty, 0600), which holds the site's `GOTRUE_*` settings that the base compose file only ships commented out. For example, phone sign-in needs `GOTRUE_SMS_PROVIDER=twilio` and the `GOTRUE_SMS_TWILIO_*` credentials there | +| `supabase-stack` | (kind `supabase`, second pass) a self-hosted Supabase stack of its own under `~/www//supabase` (compose project `-supabase`, api `8200+n`, db `5500+n`, pooler `6600+n`, subnet `172.31.(100+n).0/24`, `n = port-3200`), public host `supabase.` added to the site's cert/vhost/dns via `sites.d`. The `auth` service also reads `volumes/auth/auth.env` (created empty, 0600), which holds the site's `GOTRUE_*` settings that the base compose file only ships commented out. For example, phone sign-in needs `GOTRUE_SMS_PROVIDER=twilio` and the `GOTRUE_SMS_TWILIO_*` credentials there. Phone signup is off unless auth.env sets `GOTRUE_SMS_PROVIDER` or `GOTRUE_HOOK_SEND_SMS_ENABLED`, and phone (like email) autoconfirm is always off: upstream ships both on, which hands a session to any made-up number | | `supabase-pull` | dumps the cloud project through its session pooler (password from the app's `SUPABASE_DB_PASSWORD`, or `--reset-password` through the management API) into `/root/dumps/-supabase-` | | `supabase-load` | loads it (extensions, schema, data, grants, buckets, absolute storage-URL rewrite over every text/json column, realtime, cron) | | `supabase-storage` | copies every Storage object through the two Storage APIs (node in a container on dev2; resumable) | diff --git a/dev2/templates/supabase-stack.sh b/dev2/templates/supabase-stack.sh index d4456b0..2009596 100755 --- a/dev2/templates/supabase-stack.sh +++ b/dev2/templates/supabase-stack.sh @@ -228,6 +228,17 @@ set_env POOLER_PROXY_PORT_TRANSACTION "$POOLER_PORT" set_env DISABLE_SIGNUP false set_env ENABLE_EMAIL_SIGNUP true set_env ENABLE_EMAIL_AUTOCONFIRM false +# Upstream .env.example ships phone signup ON with SMS autoconfirm ON. With no +# SMS provider, POST /auth/v1/signup {phone,password} then returns a live session +# for any made-up number, skipping email confirmation entirely; with a provider, +# autoconfirm still skips the OTP. So: autoconfirm always off, and phone signup +# only on for a site whose auth.env configures a way to send the SMS. +set_env ENABLE_PHONE_AUTOCONFIRM false +if grep -qE '^GOTRUE_(SMS_PROVIDER|HOOK_SEND_SMS_ENABLED)=' "$DIR/volumes/auth/auth.env" 2>/dev/null; then + set_env ENABLE_PHONE_SIGNUP true +else + set_env ENABLE_PHONE_SIGNUP false +fi if [ -n "${SMTP_PASS:-}" ]; then set_env SMTP_HOST smtp.resend.com; set_env SMTP_PORT 465; set_env SMTP_USER resend; set_env SMTP_PASS "$SMTP_PASS" set_env SMTP_SENDER_NAME "${SMTP_SENDER:-$SITE}"; set_env SMTP_ADMIN_EMAIL "${SMTP_ADMIN:-noreply@$SITE}"